The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

If the user data being processed in a redirect contains an absolute URL,

modify the domain name within the URL, and test whether the applica-

tion redirects you to the different domain.

■

If the user data being processed contains a relative URL, modify this into

an absolute URL for a different domain, and test whether the application

redirects you to this domain.

■

In both cases, if you see behavior like the following, then the application

is certainly vulnerable to an arbitrary redirection attack:

GET /redir.php?target=http://wahh-attacker.com/ HTTP/1.1

Host: wahh-app.com

HTTP/1.1 302 Object moved

Location: http://wahh-attacker.com/

70779c12.qxd:WileyRed  9/14/07  3:14 PM  Page 430

---

Circumventing Obstacles to Attack

It is very common to encounter situations in which user-controllable data is

being used to form the target of a redirect, but is being filtered or sanitized in

some way by the application, usually in an attempt to block redirection

attacks. In this situation, the application may or may not be vulnerable, and

your next task should be to probe the defenses in place to determine whether

they can be circumvented to perform arbitrary redirection. The two general

types of defense you may encounter are attempts to block absolute URLs, and

the addition of a specific absolute URL prefix.